Migration in progress. api.legendary-arena.com and PostgreSQL are moving from Render to a self-hosted DigitalOcean Ubuntu host behind Cloudflare. Render remains rollback-ready until decommission phase.

Secrets and Environment

Define and protect the server environment contract that moved from Render secret storage to host-managed secret files.

Summary

Use infra/.env.example as the placeholder reference only. Real values must never be committed.

Required posture

• Runtime secret file path: /etc/la/.env
• File mode: 600
• Owner: root (or tightly controlled service owner)
• Source of truth: secure secret manager or manual secure injection

Scope of values

The environment contract includes:

• database URL and runtime port values
• JWT and auth provider secrets
• Stripe keys and webhook secrets
• anti-abuse submit tokens
• Cloudflare R2 credentials
• Brevo alert credentials

Verification

sudo test -f /etc/la/.env
sudo stat -c '%a %U:%G %n' /etc/la/.env

Expected:

• file exists
• mode is 600
• ownership matches host policy

Rotation practice

• rotate compromised or shared secrets immediately
• restart service after secret updates
• document rotation event and impact window in ops notes

References

• Plan section 4.5 secrets-and-env page stub
• Plan section 10 open items and ownership notes